Apache CouchDB Cross Site Request Forgery Vulnerability

Bugtraq ID:	42501
Class:	Design Error
CVE:	CVE-2010-2234
Remote:	Yes
Local:	No
Published:	Aug 17 2010 12:00AM
Updated:	Apr 13 2015 09:49PM
Credit:	anonymous
Vulnerable:	Apache CouchDB 0.11 Apache CouchDB 0.10.2 Apache CouchDB 0.10.1 Apache CouchDB 0.10 Apache CouchDB 0.9.2 Apache CouchDB 0.9.1 Apache CouchDB 0.9
Not Vulnerable:	Apache CouchDB 1.0.1 Apache CouchDB 0.11.2 Apache CouchDB 0.11.1

Apache CouchDB Cross Site Request Forgery Vulnerability

Apache CouchDB is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to gain unauthorized access to the affected application and perform certain actions in the context of the 'Futon' administration interface; other attacks are also possible.

Versions prior to CouchDB 0.11.1 are vulnerable.

Apache CouchDB Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.

Apache CouchDB Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apache CouchDB Cross Site Request Forgery Vulnerability

References:

• Apache CouchDB Download Page (Apache Software Foundation)
  
• Apache CouchDB Homepage (Apache Software Foundation)
  
• Apache CouchDB Wiki Breaking Changes (Apache Software Foundation)